Generating a trigger pulse at the right point in time is essential in fault injection and side channel analysis testing. Clock jitter and random program interrupts may however make this difficult. This may result in inaccurate timing of the injection of faults. Or, when performing side channel analysis, the measurement window may be unnecessary large resulting in a slow data acquisition process, an excessive amount of data, and strongly misaligned traces. In these situations, it would be much better to detect a pattern in the signal just before the point a fault should be injected or a measurement should start.
icWaves offers a solution for this. This FPGA-based device generates a trigger pulse after real-time detection of a pattern in the power or EM signal of a chip. icWaves has a special narrow band-pass filter built in to enable the detection of a pattern even in noisy signals. The latter is important because side channel signals are typically noisy and detecting a predefined pattern is therefore not always feasible without a tuneable filtering mechanism. Besides triggering a fault, icWaves is also used to prevent a smart card from shutting down after detecting a fault injection attack. By detecting the wave pattern that indicates the shutdown of the card, icWaves generates a trigger to stop the shutdown process.
icWaves is controlled with the Inspector software. It is interoperable with all hardware components. icWaves works on smart cards and embedded chipsets, and supports Inspector’s functionality for power and electromagnetic analysis (DPA, DEMA) and per turbation attacks with laser, voltage and clock glitches.
icWaves can also be operated without using Inspector software. A Software Development Kit (SDK) is provided for integrating icWaves in your custom tools. It contains a documented standard C API (Application Programmers Interface) and an example program that shows how to use the API functions. The Inspector software uses this same API, so all the icWaves features available in Inspector can also be used from your custom software.
- 8 MS memory depth for acquiring a reference trace
- Sample rate up to 200 MS/s with 8 bit resolution (oversampling is used for lower sample rates)
- Reference signal(s) can contain up to 1×1024 or 2×512 samples
- Real-time comparison uses Sum of Absolute Differences (SAD)
- Pattern-to-trigger delay around 250 ns
- Narrow band-pass filter with bandwidth of 1 MHz and adjustable centre frequency from 0 to 400 MHz
TTL-level trigger output (Trigger out):
- Configurable hold off time (5 ns resolution)
- Configurable delay (5 ns resolution)
- Possibility to specify number of patterns to skip before trigger
- Fixed pulse length of 1 microsecond
- Filter in: analog input signal for tunable band-pass filter with selectable sensitivity between 16mV p-p and 128mV p-p , 50 Ω
- Filter out: analog output signal of tuneable band- pass filter, signal level 500mV p-p , 50 Ω
- Signal in: analog input signal, 4V p-p , 50/1M Ω
- Trigger in (1×) / out (2×): TTL-level trigger in/output
The Quick Start Guide
- Contact us
Bartek Gedrojc 大虎
- Sales and Business Development Director Tools